Subject: Re: Escaping control characters in HTTP Digest (RFC 2617) (was: Escaping <\> in HTTP Digest (RFC 2617))

From: "Robert Sayre" <[email-masked]>
Date: Thu, 24 May 2007 12:57:35 -0400

On 3/23/07, Eric Lawrence <[email-masked]> wrote:
>
> IE7 uses WDigest.dll, which escapes the \ into \\.
> IE6 and previous versions relied on Digest.dll, which did not escape the \.

What about control characters? Is there any reason to allow them,
escaped or not? I'm actually having problems with malicious
XMLHttpRequest scripts doing this.

-- 

Robert Sayre

---

From: Eric Lawrence <[email-masked]>
Date: Thu, 24 May 2007 10:31:45 -0700

I think the trick is distinguishing between a control character and a byte that's part of a multi-byte international character.

Obviously, we'd need to escape any byte not valid in HTTP headers (e.g. 0x0d, 0x0a) to ensure the integrity of the headers.

-----Original Message-----
From: Robert Sayre [mailto:[email-masked]]
Sent: Thursday, May 24, 2007 9:58 AM
To: Eric Lawrence
Cc: Alexey Melnikov; [email-masked]
Subject: Re: Escaping control characters in HTTP Digest (RFC 2617) (was: Escaping <\> in HTTP Digest (RFC 2617))

--

Robert Sayre

---

From: "Robert Sayre" <[email-masked]>
Date: Thu, 24 May 2007 15:27:37 -0400

> I think the trick is distinguishing between a control character and a byte that's part of a multi-byte international character.

Perhaps I'm a little confused. I think a concrete example would help.
Let's say the username contains such characters. What does the
Authorization header look like?

Authorization: Digest username="??????"

- Rob

---

From: Henrik Nordstrom <[email-masked]>
Date: Thu, 24 May 2007 22:15:26 +0200

> Obviously, we'd need to escape any byte not valid in HTTP headers (e.g. 0x0d, 0x0a) to ensure the integrity of the headers.

The quoting productions in RFC2616 isn't very obvious, but technically
the syntax allows any characer 0-127 quoted. 8-bit characters is not
allowed in HTTP anywhere which kind of rules out the use of most
multi-byte characters without recoding them first..

HTTP builds on MIME which builds on RFC822, and it's successor RFC2822
is good reading regarding these things and an example where the BNF has
been constructed such that it clearly separates producer rules from
parser rules, with strict producer rules and relaxed parser rules
accepting many "obsolete" things.

But yes, in HTTP it's a bit of a mess. I do not think many
implementations parse HTTP entirely correct, nor am I sure it's a
desirable thing to parse HTTP fully to the specs as it requires the
parser to allows a great deal of crap nobody expects as it's not allowed
to produce..

To be honest I don't think many MIME parses passes the full RFC2822
requirements either..

Regards
Henrik

---

From: "Robert Sayre" <[email-masked]>
Date: Thu, 24 May 2007 20:33:26 -0400

On 5/24/07, Henrik Nordstrom <[email-masked]> wrote:
> the syntax allows any characer 0-127 quoted.

Do servers actually allow any character 0-127 quoted? So far, my
research suggests that they don't.

-- 

Robert Sayre

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 25 May 2007 07:48:36 +0200

tor 2007-05-24 klockan 22:15 +0200 skrev Henrik Nordstrom:
> 8-bit characters is not

Err.. Sorry, ISO-8859-1 except CTL is allowed in most places (TEXT).
Other charsets must be recoded using RFC2047 encoding.

Regards
Henrik

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 25 May 2007 07:49:30 +0200

> research suggests that they don't.

I don't think anyone does.

The specs is written in such manner that TEXT content is assumed, and is
probably what is intended for the digest username as well.

Regards
Henrik